TuxBot v3 Evolution: Keksec-Linked IoT/Linux Botnet with Verbatim LLM Chain-of-Thought Code Artifacts — Threadlinqs Intelligence
As of 2026-07-16, TuxBot v3 Evolution: Keksec-Linked IoT/Linux Botnet with Verbatim LLM Chain-of-Thought Code Artifacts is a medium-severity malware threat attributed to Keksec-affiliated developer, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-1397 · Severity: MEDIUM · Status: ACTIVE · Category: MALWARE
Attribution: Keksec-affiliated developer · FINANCIAL
TuxBot v3 Evolution is a multi-architecture IoT/Linux botnet framework (bot agent plus Go-based C2 with DDoS-for-hire capability) sharing dropper and C2 infrastructure with Kaitori v3.9 and AISURU,
Palo Alto Networks Unit 42 (Chris Navarrete, Asher Davila, Doel Santos) disclosed TuxBot v3 Evolution, a previously unreported IoT botnet framework consisting of a C-based bot agent that cross-compiles for ARM, ARM64, MIPS, MIPSEL, MIPS64, x86_64, PowerPC, RISC-V, s390x and other architectures (17 total build targets), paired with a Go-based command-and-control server offering DDoS-for-hire functionality over a custom protocol, an interactive SSH admin shell (TCP 2222), and a JSON machine API (TCP 9999). The framework's lineage traces to Mirai, AISURU, and the undisclosed 'Wuhan' botnet family, with DDoS attack code partially ported from the open-source MHDDoS Python toolkit (78 nominal attack vectors mapped to only 6 functional handlers, including Slowloris, Apache Range, and WordPress XMLRPC pingback floods carried over as dead code).
The most novel finding is development tradecraft rather than technical sophistication: multiple C source files retain raw LLM chain-of-thought reasoning left verbatim in comments -- self-interruptions, internal decision narration, and direct references to 'the user' (the developer who prompted the model) -- indicating the bot's exploit VM, crypto layer, and DGA were substantially LLM-generated and shipped without review. Every .c file in the bot directory carries an unremoved AI safety disclaimer header ('for educational and authorized security research only'), and the LLM hallucinated a Argon2id key-derivation implementation that the developer shipped without verifying; at runtime it silently falls back to PBKDF2-SHA256 while still claiming Argon2id in its packet framing.
Operationally, the malware is roughly 70% functional. Its Telnet brute-forcer (1,496 credential pairs sourced from a 'DDOS-ROOTSEC pass_file' set, XOR-obfuscated with key 0xB4), ADB scanner, and SSH/HTTP scanners work as intended and represent the primary functional infection vector. Of 25 embedded IoT-exploit CVE targets, 13 are dead code never invoked, and 12 more are non-functional because the custom exploit-VM compiler emits magic value 0x54555845 ('TUXE') while the VM runtime expects 0x4558504C ('EXPL') -- a build/runtime mismatch that silently breaks every compiled exploit. IRC and HTTP C2 fallback channels are similarly broken due to a string-table XOR key mismatch (entries encrypted with 0x54, decrypted at runtime with 0xB4).
Working C2 channels use X25519 key exchange and ChaCha20-Poly1305 authenticated encryption with a 0xDEADBE01 handshake magic and 0xDEADBEEF packet magic; a SHA-512-based DGA (seed format '%04d-%02d-%02d-TuxBotv3-Evolution-Seed-2025-%d', 20 candidates/day across six TLDs) and a TCP 13337 P2P gossip protocol using Ed25519 signatures provide resilience if the primary C2 (209.182.237.133) is taken down. A dropper server at 185.10.68.127 (Iceland, FlokiNET bulletproof hosting) also serves Kaitori v3.9 binaries at the same path convention, directly linking TuxBot's operator to the Keksec/AISURU DDoS-for-hire ecosystem; passive DNS on that IP surfaces additional DDoS-for-hire domains active since 2021 (vrunabo.su, rezy1337.ted.ge, high.cpu.co.ua). Development artifacts trace a leaked internal hostname (newtuxdev.sevielw.digikalas.online) and a developer-registered domain (digikalas.online, Namecheap, Icelandic WHOIS privacy, hosted on Iranian Arvan Cloud) back to a January 2025 MHDDoS git clone, with production-quality (GCC 14.2.0) samples still being built and benchmarked as of April 2026.
Weaknesses (CWE)
CWE-798, CWE-306, CWE-327
Target sectors: iot-consumer-devices, telecoms, critical-infrastructure-embedded-systems
Target regions: Global
Detections & IOCs
As of 2026-07-21, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, MEDIUM, threat intelligence, cybersecurity, CVE-2013-7471, CVE-2014-8361, CVE-2017-17215, CVE-2018-10561, CVE-2022-30525, CVE-2023-39780, CVE-2020-8515, CVE-2022-1388, CVE-2022-22965, CVE-2022-44877, T1595, T1583, T1583, T1588, T1588, T1190, T1110, T1059, T1543, T1027